OFFICE OF THE CHIEF OF POLICE 


SPECIAL ORDER NO. 17 August 28, 2012 

APPROVED BY THE BOARD OF POLICE COMMISSIONERS ON AUGUST 28, 2012 

SUBJECT: REPORTING SUSPICIOUS ACTIVITY POTENTIALLY RELATED 

TO FOREIGN OR DOMESTIC TERRORISM - REVISED; AND SUSPICIOUS 
ACTIVITY REPORT NOTEBOOK DIVIDER, FORM 18.30.03 - REVISED 

PURPOSE: This Order revises the procedures for reporting suspicious 

activity potentially related to foreign or domestic 
terrorism to be consistent with the Office of the Director of National 
Intelligence, Information Sharing Environment Functional Standards 
Suspicious Activity Reporting. Officers are reminded of the Fourth 
Amendment to the United States Constitution as it pertains to search 
and seizure, and the United States Supreme Court Case Terry vs. Ohio 
as it pertains to stop and frisk. Furthermore, the Office of the 
Inspector General will review the Suspicious Activity Report process 
on an annual basis as part of their audit/inspection responsibilities. 

PROCEDURE: Attached are the revised Department Manual Section 1/590, 

renamed as Reporting Suspicious Activity Potentially 
Related to Foreign or Domestic Terrorism; Section 4/271.46, Reporting 
Suspicious Activity Potentially Related to Foreign or Domestic 
Terrorism; and the Suspicious Activity Report (SAR) Notebook Divider, 
Form 18.30.03, with revisions in italics. Manual Section 4/271.46 
is revised to provide relevant definitions and clarifies the employee's 
responsibilities regarding the investigation and reporting of 
suspicious activity. 

FORM AVAILABILITY: The Suspicious Activity Report Notebook Divider is 
available in LAPD E-Forms on the Department's Local Area Network (LAN). 
All other versions of the SAR Notebook Divider shall be marked 
"obsolete" and placed into the divisional recycling bin. 

AMENDMENTS: This Order amends Sections 1/590 and 4/271.46 of the 

Department Manual. 

AUDIT RESPONSIBILITY: The Commanding Officer, Internal Audits and 
Inspections Division, will review this directive and determine whether 
an audit or inspection will be conducted in accordance with Department 
Manual Section 0/080.30. 



CHARLIE BECK \ 
Chief of Police 


Attachments 


DISTRIBUTION "D" 



DEPARTMENT MANUAL 
VOLUME I 

Revised by Special Order No. 17, 2012 

590. REPORTING SUSPICIOUS ACTIVITY POTENTIALLY RELATED TO FOREIGN 
OR DOMESTIC TERRORISM. It is the policy of the Los Angeles Police Department to 
make every effort to accurately and appropriately gather, record and analyze information of a 
criminal or non-criminal nature that could indicate activities or intentions related to either 
foreign or domestic terrorism. These efforts shall be carried out in a manner that protects the 
information, privacy and legal rights of Americans, and therefore, such information shall be 
recorded and maintained in strict compliance with existing federal, state and Department 
guidelines regarding Criminal Intelligence Systems [28 Code of Federal Regulations (CFR), 

Part 23 and applicable California State Guidelines]. 



DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17, 2012 

271.46 REPORTING SUSPICIOUS ACTIVITY POTENTIALLY RELATED TO 
FOREIGN OR DOMESTIC TERRORISM. 

DEFINITIONS. 

Suspicious Activity. Suspicious Activity is defined as observed behavior reasonably indicative of 
pre-operational planning related to terrorism or other criminal activity. 

Terrorism. Terrorism is defined as the unlawful use of force and violence against persons or 
property to intimidate or coerce a government, the civilian population, or any segment thereof, 
in furtherance ofpolitical or social objectives. This is consistent with the Code of Federal 
Regulations (28 C.F.R. Section 0.85). This definition includes individuals and groups who plan, 
threaten, finance, aid/abet, and attempt or perform unlawful acts in furtherance of terrorist 
activity. 

Suspicious Activity Report. A Suspicious Activity Report (SAR), Form 03.24.00, is an official 
documentation of observed behavior reasonably indicative of pre-operational planning related 
to terrorism or other criminal activity. The SAR is a stand-alone report. The information 
reported in a SAR may result from observations or investigations by police officers, or may be 
reported to them by private sources. 

These terrorism-related behaviors may indicate intelligence gathering or pre-operational 
planning related to terrorist activities or other criminal activity. These activities and behaviors 
include: 

Criminal Activity and Potential Terrorism Nexus Activity. 

• Breach/Attempted Intrusion. Unauthorized individuals attempting to or actually 
entering a facility/infrastructure or protected site; 

• Misrepresentation. Presenting false or misusing insignia, documents, and/or 
identification to misrepresent one’s affiliation to cover possible illicit activity. 
Impersonation of any authorized personnel (e.g., police, security, or janitor); 

• Theft/Loss/Diversion. Stealing or diverting (obtaining or acquiring) something 
associated with a facility/infrastructure [e.g., badges, uniforms, identification, emergency 
vehicles, technology or documents (classified or unclassified), which are proprietary to 
the facility]; 

• Sabotage/Tampering/Vandalism. Damaging, manipulating, or defacing part of a 
facility/infrastructure or protected site; 

• Cyber Attack. Compromising or attempting to compromise or disrupt an organization’s 
information technology infrastructure; 

• Expressed or Implied Threat. Communicating a spoken or written threat to damage or 
compromise a facility/infrastructure, protected site, and cyber-attacks; or, 

• Aviation Activity. Operation or attempted operation of an aircraft in a manner that 
reasonably may be interpreted as suspicious or posing a threat to people, 
buildings/facilities, infrastructures, or protected sites. Such operation may or may not be 
a violation of Federal Aviation Administration regulations. 
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DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17, 2012 


Potential Criminal or Non-Criminal Activity Requiring Additional Fact Information 
During an Investigation. 

• Eliciting Information. Questioning individuals at a level beyond mere curiosity about 
particular facets of a facility's or building's purpose, operations, security procedures, etc., 
that would arouse suspicion in a reasonable person; 

• Testing or Probing of Security. Deliberate interactions with, or challenges to, 
installations, personnel, or systems that reveal physical, personnel or cyber security 
capabilities; 

• Recruiting. Building of operations teams and contacts, personal data, banking data or 
travel data; 

• Photography. Taking pictures or videos of facilities/buildings, infrastructures, or 
protected sites in a manner that would arouse suspicion in a reasonable person. Examples 
include taking pictures or videos of ingress/egress, delivery locations, personnel 
performing security functions (e.g., patrol, badge/vehicle checking), security-related 
equipment (e.g., perimeter fencing, security cameras), etc.; 

• Observation/Surveillance. Demonstrating unusual interest in facilities/buildings, 
infrastructures or protected sites beyond mere casual or professional (e.g., engineers) 
interest, such that a reasonable person would consider the activity suspicious. Examples 
include observations through binoculars, taking notes, attempting to measure distances, 
etc.; 

• Materials Acquisition/Storage. Acquisition and/or storage of unusual quantities of 
materials such as cell phones, pagers, fuel, chemicals, toxic materials, and timers, such 
that a reasonable person would consider the activity suspicious; 

• Acquisition of Expertise. Attempts to obtain or conduct training in security concepts, 
military weapons or tactics, or other unusual capabilities such that a reasonable person 
could consider the activity suspicious; 

• Weapons Discovery. Discovery of unusual amounts of weapons, explosives, or their 
components that would arouse suspicion in a reasonable person; or, 

• Sector-Specific Incident. Actions associated with a characteristic of unique concern to 
specific sectors (such as the public health sector) with regard to their personnel, facilities, 
systems or functions. 

Note: These activities are generally protected by the First Amendment to the United States 
Constitution and should not be reported in a SAR, absent articulable facts and circumstances 
that support suspicion that the behavior observed is not innocent, but rather reasonably 
indicative of criminal activity associated with terrorism, including evidence of 
pre-operationalplanning related to terrorism. Race, ethnicity, national origin, or religious 
affiliation should not be considered as factors that create suspicion (although these factors 
may be used as specific-involved person descriptors). 

Involved Person (IP). An involved person (IP) is an individual who has been observed engaging 
in suspicious activity, when no definitive criminal activity is identified, thus precluding their 
identification as a suspect. 
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DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17, 2012 

Potential Target. A potential target is a person, facility/building, infrastructure or protected 
site that is or may be the object of the suspicious activity. 

REPORTING AND INVESTIGATIVE RESPONSIBILITIES FOR SAR-RELATED 
INCIDENTS AND CRIME AND/OR ARREST REPORTS. All reports of suspicious 
activity is to be reported on a SAR. The Division of Records (DR) number for all associated 
reports (e.g., Property Report, Form 10.01.00; Investigative Report (IR), Form 03.01.00; and 
Arrest Report, Form 05.02.00) is to be listed in the space provided on the upper left-hand comer 
of the SAR face sheet. 

Employee's Responsibilities. Any Department employee receiving any information regarding 
suspicious activity and/or observing any suspicious activity is to investigate and take appropriate 
action, including any tactical response or notifications to specialized entities. 

Note: This section does not preclude, in any way, an employee taking immediate action during 
the commission of a criminal act, or in circumstances which require the immediate defense of 
life, regardless of the nature of origin. 

Activities that are generally protected by the First Amendment should not be reported as a SAR, 
unless additional facts and circumstances can be clearly articulated that support an officer’s or 
agency’s determination that the behavior observed is reasonably indicative of criminal activity 
associated with terrorism or other criminal activity. 

Officers are reminded of constitutional and case law as they pertain to search and seizure, and 
to stop and frisk. Officers, who have neither reasonable suspicion to detain nor probable cause 
to arrest, cannot legally prevent an individual from walking away. 

Consensual Encounter. A consensual encounter is an encounter between a police officer and 
an individual in which the individual voluntarily agrees to stop and speak with the officer. 

The individual is free to leave at any time during a consensual encounter unless there is 
reasonable suspicion to detain or probable cause to arrest. 

Lawful Detention. A lawful detention must be based on reasonable suspicion that criminal 
activity has taken place or is about to take place, and that the person detained is connected to 
that activity. 

Arrest. Probable cause to arrest is a set offacts that would cause a person of ordinary care and 
prudence to entertain an honest and strong suspicion that the person to be arrested is guilty of a 
crime. 
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DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17, 2012 


• If the suspicious activity observed (e.g., suspicious behaviors or activities only) is not 
directly related to a reportable crime and/or any other type of investigation: 

o Record the information collected from the person reporting, or officer’s 
observations on a SAR; 

o If the potential target of the activity can be identified (e.g., government, person, 
building/facility, infrastructure or protected site, or an official being surveilled), 
that location or individual is to be listed within the “Potential Target" section of 
the SAR. Otherwise the “City of Los Angeles” is to be listed as the potential 
target; 

o List the person reporting within the “Witness” section of the SAR. If the person 
reporting refuses to identify themselves, list them as “Anonymous”; 

o List any additional witnesses; 

o List the parties engaged in the suspicious behavior as Involved Persons within the 
“Involved Persons” portion of the SAR. With no reportable crime, they cannot 
be listed as suspects. Utilize page 2 of the SAR to include additional descriptive 
information; 

o Notify the watch commander, Area of occurrence. Upon approval by the watch 
commander, ensure that the Area Records Unit is made aware of the report and 
immediately assigns a DR and incident number for the SAR. Refer to the Area 
Records Unit’s Responsibilities Note Section regarding manual DR numbers; 

o If there is property or evidence associated with the suspicious activity, a separate 
Property Report is to be completed. The Property Report is to bear a 
separate DR and incident number from the SAR, along with the following: 

■ The Evidence box is to be marked; 

• The Investigative Unit box is to be Major Crimes Division (MCD); 

■ The Connecting Reports box is to be marked “None”; 

■ In the narrative portion of the report, officers are to write, “Do not release 
or destroy prior to contacting MCD. Below listed property booked on 
advice from MCD”; 

o The Property Report DR number is to be referenced in the “Prop Rpt DR#” 
box provided on the upper left-hand corner of the SAR face sheet; 

o The booked property and the Property Report is to remain in the division of 
occurrence; 

o Send the original SAR to Counter Terrorism and Special Operations Bureau 
(CTSOB)/MCD, Stop 400, as soon as practicable, but no later than 24 hours after 
the report is taken and faxed to MCD. No copies of the SAR are to be 
maintained at the Area. 

Note: The SAR DR and incident numbers are not to be referenced in the Property Report or any 
other report. 
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DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17, 2012 

• If the suspicious activity observed is related to a criminal or other type of 

investigation (e.g., bomb threat, vandalism, trespass, assault, domestic violence, 
impound, narcotics, property report, etc.), officers are to complete the following: 

o Complete the investigation and any appropriate reports [e.g., IR; Arrest Report; 
Property Report; Vehicle Report, CHP 180 (impound) and/or any other related 
reports]; 

o Complete a SAR with a separate DR and incident number. Refer to the Area 
Records unit’s Responsibilities Note Section regarding manual DR numbers; 

o Ensure that the DR number(s) of all completed crime, arrest, and/or 

property reports are listed and referenced in the appropriate boxes provided 
in the upper left-hand corner of the SAR face sheet. Include any additional 
information that provides the nexus to terrorism within the narrative of the SAR 
on page 2; 

o Ensure that the SAR DR and incident numbers are not referenced in any 
other reports, e.g., crime, arrest, etc.; 

Note: The physical disclosure of a SAR during criminal and/or civil discovery should only 
occur pursuant to a lawful court order. 

o Notify the watch commander, Area of occurrence. Upon approval by the watch 
commander, ensure that the Area Records Unit is made aware of the report. 

These reports are to be processed separately; 

o Notify MCD [contact Real-Time Analysis and Critical Response (RACR) 

Division for off-hours notification] if the report involves an arrest or a crime with 
follow-up potential; and, 

o Send the original SAR, including a copy of all associated reports, to 

CTSOB/MCD, Stop 400, as soon as practicable, but no later than 24 hours after 
the report is taken and faxed to MCD. No copies of the SAR are to be 
maintained at the Area. 

Note: Employees may reference that a SAR was completed and indicate the SAR DR number 
only, and not the involved person’s information in their Daily Field Activities Report (DFAR), 

Form 15.52.00, e.g., “a SAR was completed, DR No._The involved person’s name(s) from 

the SAR are not to be documented on the aforementioned report or any other related reports, 
e.g., IR, Arrest, etc. 

Hazardous Devices Materials Section, Emergency Services Division - Responsibility. 

Personnel assigned to the Explosive Unit (Bomb Squad), Hazardous Materials Unit, or 
Los Angeles Police Department Bomb Detection Canine (K-9) Section are to ensure that a SAR 
is completed on all incidents on which they respond where a potential nexus to terrorism exists. 
Suspicious Activity Reports completed by personnel assigned to these units shall be processed 
through a geographic Area Records Unit as directed below. 



DEPARTMENT MANUAL 
VOLUME IV 

Revised by Special Order No. 17,2012 

Watch Commander’s Responsibilities. Upon notification that officers have received 
information regarding suspicious activity, the watch commander is to: 

• Ensure that the information supports the completion of a SAR and that no greater law 
enforcement response or notifications to MCD are currently needed; 

• Review the SAR for completeness; and, 

• Ensure the Area Records Unit immediately assigns a DR number for the SAR, enters the 
information into the Consolidated Crime Analysis Database (CCAD) system, forwards 
the original SAR, including a copy of all associated reports to MCD, and faxes all 
reports to MCD no later than 24 hours after the report is taken. Refer to the Area 
Records Unit’s Responsibilities Note Section regarding manual DR numbers. 

Note: Supervisors and watch commanders may reference that a SAR was completed and 
indicate the SAR DR number only, and not the involved person’s information in their Sergeant’s 
Daily Report, Form 15.48.00, or Watch Commander’s Daily Report, Form 15.80.00, e.g., “SAR 

report completed, DR No._The involved person’s name(s) from the SAR is not to be 

documented on the aforementioned reports or any other related reports, e.g., IR, Arrest, etc. 

Major Crimes Division's Responsibilities. Upon receiving a telephonic notification of 
suspicious activity, MCD personnel will, when appropriate, conduct immediate debriefs of 
arrestees, and/or witnesses, and provide the appropriate guidance to patrol officers. Upon 
receiving a SAR which has been forwarded and faxed to MCD, assigned MCD personnel are to 
follow established protocols regarding the processing of such information. Refer to the Area 
Record Unit’s Responsibilities Note Section regarding manual DR numbers and MCD’s 
responsibilities in reference to this. 

Area Records Unit's Responsibilities. Upon receipt of the original SAR and associated reports 
(e.g., Property Report, IR, and/or Arrest Report, etc.), records personnel are to: 

• Assign DR number(s) for the SAR and other related reports, as appropriate; 

Note: If unable to obtain a DR number, DO NOT obtain a manual DR number for the SAR 
and do not keep a copy of the SAR. Forward the original SAR to the SAR Unit, MCD, Stop 400 
and fax it to MCD. The SAR Unit personnel will obtain the required DR number and incident 
number. If an arrest is involved, MCD will notify the Area of a manual SAR DR number. 

• Ensure that the DR number(s) of all associated reports (crime, arrest, property, and/or 
impound report, etc.) are listed in the appropriate boxes provided on the face sheet of the 
SAR; 

• Enter the information into the CCAD system, including any appropriate CTSOB -related 
codes; and, 

• Send the original SAR, including a copy of all associated reports, to 
“CTSOB/MCD, Stop 400” as soon as practicable, but no later than 24 hours after 
the report is taken and faxed to MCD. No copies of the SAR are to be maintained at 
the Area. 
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Area Detective's Responsibilities. For any associated reports, fe.g.. Property Report. IR, and/or 
Arrest Report, etc.), which arrive at an Area Detective Division without having been reviewed by 
MCD personnel. Area detectives are to: 

• Immediately notify MCD and forward the SAR to MCD (No copies of the SAR are to be 
retained at the Area) and fax copies of the SAR and all reports to MCD. Refer to the 
Area Records Unit’s Responsibilities Note Section regarding manual DR numbers; 

• Ensure the SAR has been screened by MCD personnel, and, 

• Complete any criminal investigation per existing Department policies and 
guidelines. 

Counter-Terrorism and Special Operations Bureau - Responsibility. Counter-Terrorism and 
Special Operations Bureau is responsible for providing Department personnel with training 
pertaining to the proper handling of suspected terrorism-related activity and ensuring adherence 
to the guidelines established regarding developmental information and intelligence systems. 
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SUSPICIOUS ACTIVITY REPORT 

These guidelines should be followed for investigations of Suspicious Activity. 


POLICY: 

It is the policy of the Los Angeles Police Department to make 
every effort to accurately and appropriately gather, record and 
analyze information of a criminal or non-criminal nature that 
could indicate activities or intentions related to either foreign or 
domestic terrorism, in a manner that protects the information, 
privacy and legal rights of Americans. 

DEFINITIONS: 

SUSPICIOUS ACTIVITY 

Suspicious Activity is defined as observed behavior reasonably 
indicative of pre-operational planning related to terrorism or 
other criminal activity. 

TERRORISM 

Terrorism is defined as the unlawful use of force and violence 
against persons or property to intimidate or coerce a 
government, the civilian population, or any segment thereof, in 
furtherance of political or social objectives. This is consistent 
with the Code of Federal Regulations (28 C.F.R. Section 0.85). 
This definition includes individuals and groups who plan, 
threaten, finance, aid/abet, and attempt or perform unlawful 
acts in furtherance of terrorist activity. 

SUSPICIOUS ACTIVITY REPORT 

A Suspicious Activity Report (SAR), Form 03.24.00, is an 
official documentation of observed behavior reasonably 
indicative of pre-operational planning related to terrorism or 
other criminal activity. The SAR is a stand-alone report . The 
information reported in a SAR may result from observations or 
investigations by police officers, or may be reported to them by 
private sources. 

Note: A SAR shall only be completed for those activities and 
behaviors specifically listed or defined under “Reportable 
Suspicious Activities” (see page 2). 

INVOLVED PERSON 

An involved person (IP) is an individual who has been 
observed engaging in suspicious activity, when no definitive 
criminal activity can be identified, thus precluding their 
identification as a suspect. 

POTENTIAL TARGET 

A potential target is a person, facility/building, infrastructure or 
protected site that is or may be the object of the suspicious 
activity. 

EMPLOYEE’S REPORTING RESPONSIBILITIES: 

Any Department employee receiving any information regarding 
suspicious activity and/or observing any suspicious activity 
shall investigate and take appropriate action, including any 
tactical response or notifications to specialized entities. 

I. If the suspicious activity observed (e.g., suspicious 
behaviors or activities only) is not directly related to a 
reportable crime and/or any other type of investigation: 

□ Record the information collected from the person reporting, 
or officer’s observations on a SAR; 

□ If the potential target of the activity can be identified (e.g., 
government, person, building/facility, infrastructure or protected 
site, or an official being surveilled), that location or individual is 
to be listed within the “Potential Target” section of the SAR. 
Otherwise the “City of Los Angeles” is to be listed as the 
potential target; 


□ List the person reporting within the “Witness” section of the 
SAR. If the person reporting refuses to identify themselves, list 
them as “Anonymous”; 

□ List any additional witnesses; 

□ List the parties engaged in the suspicious behavior as 
Involved Persons within the “Involved Persons” portion of the 
SAR. With no reportable crime, they cannot be listed as 
suspects . Utilize page 2 of the SAR to include additional 
descriptive information; 

□ Notify the watch commander, Area of occurrence. Upon 
approval by the watch commander, ensure that the Area 
Records Unit is made aware of the report and immediately 
assigns a DR and incident number for the SAR. Refer to the 
Area Records Unit’s Responsibilities Note Section 
regarding manual DR numbers: 

□ If there is property or evidence associated with the 
suspicious activity, a separate Property Report is to be 
completed. The Property Report is to bear a separate DR 
and incident number from the SAR. along with the 
following: 

a. The Evidence box is to be marked; 

b. The Investigative Unit box is to be Major Crimes 
Division (MCD); 

c. The Connecting Reports box is to be marked “None”; 

d. In the narrative portion of the report, officers are to 
write, “Do not release or destroy prior to contacting 
MCD. Below listed property booked on advice from 
MCD”; 

□ The Property Report DR number is to be referenced in 
the “Prop Rpt DR#” box provided on the upper left-hand 
corner of the SAR face sheet; 

□ The booked property and the Property Report is to 
remain in the division of occurrence; 

□ Send the original SAR to Counter Terrorism and Special 
Operations Bureau (CTSOB)/MCD, Stop 400, as soon as 
practicable, but no later than 24 hours after the report is taken 
and faxed to MCD. No copies of the SAR are to be 
maintained at the Area . 

Note: The SAR DR and incident numbers shall not be 
referenced in the Property Report or any other report. 

II. If the suspicious activity observed is related to a 
criminal or other type of investigation (e.g., bomb threat, 
vandalism, trespass, assault, domestic violence, impound, 
narcotics, property report, etc.), officers are to complete 
the following: 

□ Complete the investigation and any appropriate reports 
[e.g., IR; Arrest Report; Property Report; Vehicle Report, 

CHP 180 (impound) and/or any other related reports]; 

□ Complete a SAR with a separate DR and incident 
number. Refer to the Area Records Unit’s Responsibilities 
Note Section regarding manual DR numbers; 

□ Ensure that the DR number(s) of all completed crime, 
arrest, and/or property reports are listed and referenced in 
the appropriate boxes provided in the upper left-hand 
corner of the SAR face sheet. Include any additional 
information that provides the nexus to terrorism within the 
narrative of the SAR on page 2; 

□ Ensure that the SAR DR and incident numbers are not 
referenced in any other reports, e.g., crime, arrest, etc.; 

Note: The physical disclosure of a SAR during criminal 
and/or civil discovery should only occur pursuant to a 
lawful court order. 
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SUSPICIOUS ACTIVITY REPORT 

These guidelines should be followed for investigations of Suspicious Activity. 


□ Notify the watch commander, Area of occurrence. Upon 
approval by the watch commander, ensure that the Area 
Records Unit is made aware of the report. These reports are 
to be processed separately: 

□ Notify MCD [contact Real-Time Analysis and Critical 
Response (RACR) Division for off-hours notification] if the 
report involves an arrest or a crime with follow-up potential; 
and, 

□ Send the original SAR, including a copy of all associated 
reports, to CTSOB/MCD, Stop 400, as soon as practicable, but 
no later than 24 hours after the report is taken and faxed to 
MCD. No copies of the SAR are to be maintained at the Area . 

Note: Employees may reference that a SAR was completed 
and indicate the SAR DR number only and not the involved 
person’s information in their Daily Field Activities Report 
(DFAR), Form 15.52.00, e.g., “A SAR was completed, 

DR No._.” The involved person’s name(s) from the SAR are 

not to be documented on the aforementioned report or any 
other related reports, e.g., IR, Arrest, etc. 

SUPERVISORS & WATCH COMMANDERS may reference 
that a SAR was completed and indicate the SAR DR number 
only, and not the involved person’s information in their 
Sergeant’s Daily Report, Form 15.48.00, or Watch 
Commander’s Report, Form 15.80.00, e.g., “ SAR Report 

completed, DR No._." The involved person’s name(s) from 

the SAR is not to be documented on the aforementioned 
reports, or any other related reports, e.g., IR, Arrest, etc. 

Please refer to Department Manual Section 4/271.46 for the 
supervisor’s and watch commander’s responsibilities. 

NOTIFICATIONS: 

Notify CTSOB/MCD (contact RACR Division for off-hours 
notification) for guidance if the report involves any incident of 
significance, an arrest or a crime with any follow-up potential. 

REPORTABLE SUSPICIOUS ACTIVITIES: 

These terrorism-related behaviors may indicate intelligence 
gathering or pre-operational planning related to terrorist 
activities or other criminal activity. These activities and 
behaviors include: 

Criminal Activity and Potential Terrorism Nexus Activity 

• Breach/Attempted Intrusion. Unauthorized individuals 
attempting to or actually entering a facility/infrastructure or 
protected site; 

• Misrepresentation. Presenting false or misusing insignia, 
documents, and/or identification to misrepresent one’s 
affiliation to cover possible illicit activity. Impersonation of any 
authorized personnel (e.g., police, security, or janitor); 

• Theft/Loss/Diversion. Stealing or diverting (obtaining or 
acquiring) something associated with a facility/infrastructure 
[e.g., badges, uniforms, identification, emergency vehicles, 
technology or documents (classified or unclassified), which are 
proprietary to the facility]; 

• Sabotage/Tampering/Vandalism. Damaging, 
manipulating, or defacing part of a facility/infrastructure or 
protected site; 

• Cyber Attack. Compromising or attempting to compromise 
or disrupt an organization’s information technology 
infrastructure; 

• Expressed or Implied Threat. Communicating a spoken 
or written threat to damage or compromise a 
facility/infrastructure, protected site, and cyber-attacks; or, 


• Aviation Activity. Operation or attempted operation of an 
aircraft in a manner that reasonably may be interpreted as 
suspicious or posing a threat to people, buildings/facilities, 
infrastructures, or protected sites. Such operation may or may 
not be a violation of Federal Aviation Administration 
regulations. 

Potential Criminal or Non-Criminal Activity Requiring 
Additional Fact Information During an Investigation 

• Eliciting Information. Questioning individuals at a level 
beyond mere curiosity about particular facets of a facility’s or 
building’s purpose, operations, security procedures, etc., that 
would arouse suspicion in a reasonable person; 

• Testing or Probing of Security. Deliberate interactions 
with, or challenges to, installations, personnel, or systems that 
reveal physical, personnel or cyber security capabilities; 

• Recruiting. Building of operations teams and contacts, 
personal data, banking data or travel data; 

• Photography. Taking pictures or videos of 
facilities/buildings, infrastructures, or protected sites in a 
manner that would arouse suspicion in a reasonable person. 
Examples include taking pictures or videos of ingress/egress, 
delivery locations, personnel performing security functions 
(e.g., patrol, badge/vehicle checking), security-related 
equipment (e.g., perimeter fencing, security cameras), etc.; 

• Observation/Surveillance. Demonstrating unusual 
interest in facilities/buildings, infrastructures or protected sites 
beyond mere casual or professional (e.g., engineers) interest, 
such that a reasonable person would consider the activity 
suspicious. Examples include observations through 
binoculars, taking notes, attempting to measure distances, etc.; 

• Materials Acquisition/Storage. Acquisition and/or storage 
of unusual quantities of materials, such as cell phones, pagers, 
fuel, chemicals, toxic materials, and timers, such that a 
reasonable person would consider the activity suspicious; 

• Acquisition of Expertise. Attempts to obtain or conduct 
training in security concepts, military weapons or tactics, or 
other unusual capabilities such that a reasonable person could 
consider the activity suspicious; 

• Weapons Discovery. Discovery of unusual amounts of 
weapons, explosives, or their components that would arouse 
suspicion in a reasonable person; or, 

• Sector-Specific Incident. Actions associated with a 
characteristic of unique concern to specific sectors (such as 
the public health sector) with regard to their personnel, 
facilities, systems or functions. 

Note; These activities are generally protected by the 
First Amendment to the United States Constitution and should 
not be reported in a SAR, absent articulable facts and 
circumstances that support suspicion that the behavior 
observed is not innocent, but rather reasonably indicative of 
criminal activity associated with terrorism, including evidence 
of pre-operational planning related to terrorism. Race, 
ethnicity, national origin, or religious affiliation should not be 
considered as factors that create suspicion (although these 
factors may be used as specific-involved person descriptors). 

SOURCE: Department Manual Section 1/590, Reporting 
Suspicious Activity Potentially Related to Foreign or Domestic 
Terrorism and Section 4/271.46, Reporting Suspicious Activity 
Potentially Related to Foreign or Domestic Terrorism. 
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